commit e2b975c317ae9cb672be459a4ff8761aedb3157c
author Nick Wellnhofer <wellnhofer@aevum.de> Fri Dec 18 00:50:34 2020 +0100
committer Nick Wellnhofer <wellnhofer@aevum.de> Fri Dec 18 14:10:13 2020 +0100
tree 2aea8c0ea7f9f09e76002adfe844029613994ae9
parent a67b63d183f5ab5d5af70fe47ef3a3d53fa3cb09

Handle malloc failures in fuzzing code

Avoid misdiagnosis in OOM situations.

fuzz/fuzz.c

diff --git a/fuzz/fuzz.c b/fuzz/fuzz.c
index b5dfa18..212136a 100644
--- a/fuzz/fuzz.c
+++ b/fuzz/fuzz.c
@@ -211,6 +211,8 @@
 
         if (xmlHashLookup(fuzzData.entities, (xmlChar *)url) == NULL) {
             entityInfo = xmlMalloc(sizeof(xmlFuzzEntityInfo));
+            if (entityInfo == NULL)
+                break;
             entityInfo->data = entity;
             entityInfo->size = entitySize;
 
@@ -271,6 +273,10 @@
     input->filename = NULL;
     input->buf = xmlParserInputBufferCreateMem(entity->data, entity->size,
                                                XML_CHAR_ENCODING_NONE);
+    if (input->buf == NULL) {
+        xmlFreeInputStream(input);
+        return(NULL);
+    }
     input->base = input->cur = xmlBufContent(input->buf->buffer);
     input->end = input->base + entity->size;
 

fuzz/xml.c

diff --git a/fuzz/xml.c b/fuzz/xml.c
index 97b40b8..f0dcfcc 100644
--- a/fuzz/xml.c
+++ b/fuzz/xml.c
@@ -37,18 +37,14 @@
 
     /* Lower maximum size when processing entities for now. */
     maxSize = opts & XML_PARSE_NOENT ? 50000 : 500000;
-    if (size > maxSize) {
-        xmlFuzzDataCleanup();
-        return(0);
-    }
+    if (size > maxSize)
+        goto exit;
 
     xmlFuzzReadEntities();
     docBuffer = xmlFuzzMainEntity(&docSize);
     docUrl = xmlFuzzMainUrl();
-    if (docBuffer == NULL) {
-        xmlFuzzDataCleanup();
-        return(0);
-    }
+    if (docBuffer == NULL)
+        goto exit;
 
     /* Pull parser */
 
@@ -63,6 +59,8 @@
     /* Push parser */
 
     ctxt = xmlCreatePushParserCtxt(NULL, NULL, NULL, 0, docUrl);
+    if (ctxt == NULL)
+        goto exit;
     xmlCtxtUseOptions(ctxt, opts);
 
     for (consumed = 0; consumed < docSize; consumed += chunkSize) {
@@ -81,6 +79,8 @@
     /* Reader */
 
     reader = xmlReaderForMemory(docBuffer, docSize, NULL, NULL, opts);
+    if (reader == NULL)
+        goto exit;
     while (xmlTextReaderRead(reader) == 1) {
         if (xmlTextReaderNodeType(reader) == XML_ELEMENT_NODE) {
             int i, n = xmlTextReaderAttributeCount(reader);
@@ -92,10 +92,8 @@
     }
     xmlFreeTextReader(reader);
 
-    /* Cleanup */
-
+exit:
     xmlFuzzDataCleanup();
-
     return(0);
 }